# https://syzkaller.appspot.com/bug?id=e54749831bc1a3c08b63ed2d707498af1cb56bbc
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":6,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"tmpdir":true,"segv":true}
openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x200000, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@local, @in6}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8)
r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0004e3ff000003006a9104ec58a025f5fac32917cee2804b03e5c27235255dfbf6d73b3184dbdfe73d78f9bdaabbb370be7dca644662f6d5bc6507ce2e5873ed159b118f5dda62d0f79af4fa6b6899a2c9db6f4b0cfcbad9d1ce2cc018b30708452c95c8b8a0cffc9125dcaf7ad3e037034b1b0e38a3b384415eaedd"]], 0x0, 0x0, 0x0})
openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4)
r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r5=>0x0})
fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5})
prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00')
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x6a, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
getpid()
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff})
fallocate(r1, 0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)})
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10)
syz_emit_ethernet(0x0, 0x0, 0x0)
r7 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80)
fcntl$setsig(r7, 0xa, 0xb)
fcntl$setlease(r7, 0x400, 0x1)
rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8)
open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
fcntl$setlease(0xffffffffffffffff, 0x400, 0x0)
r8 = socket$packet(0x11, 0x3, 0x300)
setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10)
syz_emit_ethernet(0x0, 0x0, 0x0)
r9 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80)
fcntl$setsig(r9, 0xa, 0x0)
rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8)
open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
fcntl$setlease(r9, 0x400, 0x0)
r10 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r10, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'})
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)})
r11 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000180)={<r12=>0x0, @multicast2}, &(0x7f00000001c0)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000200)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000300)=0xe8)
accept$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, <r14=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000380)=0x14)
accept$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, <r15=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000400)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000005c0)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r16=>0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f00000006c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000740)={@broadcast, @multicast1, <r17=>0x0}, &(0x7f0000000780)=0xc)
r18 = accept4$packet(0xffffffffffffff9c, &(0x7f00000007c0)={0x11, 0x0, <r19=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000800)=0x14, 0x800)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, <r20=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000880)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f00000009c0)=0xe8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'rose0\x00', <r22=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000b00)={{{@in6, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r23=>0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000c00)=0xe8)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000c40)={0x11, 0x0, <r24=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000c80)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000cc0)={{{@in6=@mcast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r25=>0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000dc0)=0xe8)
sendmsg$TEAM_CMD_PORT_LIST_GET(r11, &(0x7f00000011c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000e00)={0x370, 0x0, 0x0, 0x70bd26, 0x25dfdbfe, {}, [{{0x8, 0x1, r12}, {0xfc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}]}}, {{0x8, 0x1, r16}, {0x1b8, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x800}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r17}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r20}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r23}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r24}}}]}}, {{0x8, 0x1, r25}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x370}}, 0x4000)
accept$packet(r18, &(0x7f0000000480), &(0x7f00000004c0)=0x14)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00', <r26=>0x0})
r27 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r27, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'})
bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r26, 0x1, 0x0, 0x6, @local}, 0x14)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141})
openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r28 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r29 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r29, &(0x7f0000000040), 0x0, 0x1}, 0x20)
r30 = creat(&(0x7f0000000640)='./file0\x00', 0x100)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r30, 0x6, 0x14, &(0x7f0000000980), 0x4)
unlink(&(0x7f0000000940)='./file0\x00')
r31 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r32 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r32, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r31, 0xc018620b, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r31, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"})
ioctl$BINDER_SET_CONTEXT_MGR(r32, 0x40046207, 0x0)
shutdown(0xffffffffffffffff, 0x1)
fcntl$getownex(r30, 0x10, &(0x7f0000000280)={0x0, <r33=>0x0})
fcntl$lock(r32, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r33})
ioctl$BINDER_WRITE_READ(r31, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r31, 0xc0306201, &(0x7f00000002c0)={0x6a, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r32, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)})
r34 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
sendmsg$TIPC_NL_BEARER_ENABLE(r34, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
getpid()
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff})
fallocate(r28, 0x0, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_open_procfs(0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x4000000001, 0x0, &(0x7f0000000240)={<r35=>0xffffffffffffffff, <r36=>0xffffffffffffffff})
r37 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0)
pwritev(r37, &(0x7f0000000440)=[{&(0x7f0000000380)='S', 0x1}], 0x1, 0x4081886)
pipe(&(0x7f00000002c0)={<r38=>0xffffffffffffffff, <r39=>0xffffffffffffffff})
getsockopt$inet6_IPV6_IPSEC_POLICY(r38, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@dev, @in=@empty}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8)
sendfile(r35, r37, 0x0, 0x100000000)
recvmmsg(r39, &(0x7f0000002380)=[{{&(0x7f0000000080)=@alg, 0x80, &(0x7f0000000980)=[{&(0x7f0000000300)=""/122, 0x7a}, {&(0x7f0000000680)=""/172, 0xac}, {&(0x7f00000003c0)=""/86, 0x56}, {&(0x7f0000000200)=""/11, 0xb}, {&(0x7f0000000740)=""/132, 0x84}, {&(0x7f0000000800)=""/65, 0x41}, {&(0x7f0000000880)=""/61, 0x3d}, {&(0x7f00000008c0)=""/74, 0x4a}, {&(0x7f0000000940)=""/26, 0x1a}], 0x9, &(0x7f0000000a40)=""/87, 0x57}, 0x2}, {{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000ac0)=""/79, 0x4f}, {&(0x7f0000000b40)=""/32, 0x20}], 0x2}, 0x3b9}, {{&(0x7f0000000bc0)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000000c40)=""/4096, 0x1000}], 0x1, &(0x7f0000001c80)=""/139, 0x8b}, 0x1}, {{&(0x7f0000001d40)=@nl=@proc, 0x80, &(0x7f0000002000)=[{&(0x7f0000001dc0)=""/88, 0x58}, {&(0x7f0000001e40)=""/247, 0xf7}, {&(0x7f0000001f40)=""/8, 0x8}, {&(0x7f0000001f80)=""/117, 0x75}], 0x4}, 0x6}, {{&(0x7f0000002040)=@l2, 0x80, &(0x7f0000002340)=[{&(0x7f00000020c0)=""/225, 0xe1}, {&(0x7f00000021c0)=""/6, 0x6}, {&(0x7f0000002200)=""/17, 0x11}, {&(0x7f0000002240)=""/211, 0xd3}], 0x4}, 0x7fbb7c32}], 0x5, 0x10020, 0x0)
recvfrom$unix(r36, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000)
fremovexattr(r36, &(0x7f0000000180)=ANY=[@ANYBLOB="73656375726974792e5b27706f7169787f8de46c5f61636365737300c5acb64534a05890b821ad52948ba2e1fd33c28220c38f1675ef97ee290d9ca2074a8d810b58bcaaaa6dff"])
ioctl$RTC_IRQP_READ(r39, 0x8008700b, &(0x7f00000024c0))
r40 = dup(0xffffffffffffffff)
r41 = openat$cgroup_type(r40, 0x0, 0x2, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4)
bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000002c0), 0x4)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x10000000000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0)
r42 = creat(&(0x7f0000000100)='./bus\x00', 0x2)
r43 = creat(&(0x7f00000002c0)='./bus\x00', 0x0)
r44 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1, 0x11, r44, 0x0)
write$P9_RSTATu(r43, &(0x7f0000000c40)=ANY=[@ANYRES32], 0x4)
fcntl$F_GET_FILE_RW_HINT(r41, 0x40d, &(0x7f0000000000))
io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r42, &(0x7f0000000000), 0xfffffc1d}])
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
fcntl$setsig(0xffffffffffffffff, 0xa, 0xb)
fcntl$setlease(0xffffffffffffffff, 0x400, 0x1)
rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8)
open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
fcntl$setlease(0xffffffffffffffff, 0x400, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0x400000000001, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002})
clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r45 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
ptrace$setopts(0x4206, r45, 0x800001, 0xffffffffffffffff)
tkill(r45, 0x38)
ptrace$cont(0x18, r45, 0x0, 0x0)
mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1)
eventfd2(0x9fc, 0x1)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x20000000, 0xa7})
ptrace$setregs(0xd, r45, 0x0, &(0x7f0000000080))
wait4(0x0, 0x0, 0x0, 0x0)
add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)="ea3d7ee9aa8d27c4e6b22700e9889c07052689bcd15494073ede88b1", 0x1c, 0x0)
open(0x0, 0x141042, 0x0)
r46 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$binfmt_elf64(r46, &(0x7f0000000800)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x1, 0x7fffffff, 0x5, 0x8, 0x3, 0xf44ef7ade82b60ac, 0x0, 0x185, 0x40, 0x38e, 0x4, 0x8, 0x38, 0x2, 0x0, 0x2, 0x1f}, [{0x6474e551, 0x4, 0xa068, 0x9, 0x7f, 0x2, 0x100000001, 0xfffffffffffffffa}], "ba7a53c7aa0153ab378278a93b23830b4c1e3cc4b67407386a6ce2b8c9fd577d3a0928b88cd3d95fbd30ed3dbbb5a7319da7b949ea497ac42d46775eef15e3b3bb288ed65bc401823c89fb7e043d2f480fb9bccf73163657614f301a2ba339b87e989a09f4c6dceacb885d6dd54d6f514906a34fec4bcb0eb96b6c", [[], [], [], [], [], [], [], [], [], []]}, 0xaf3)
ioctl$FITRIM(r46, 0xc0185879, &(0x7f00000007c0)={0x80000001})
r47 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0)
write$binfmt_elf64(r47, &(0x7f0000000480)=ANY=[], 0x2e7)
rename(0x0, &(0x7f0000000080)='./file0\x00')
unlink(&(0x7f00000002c0)='./file0\x00')
lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000200)=@v2={0x2000000, [{}, {0xffffffff, 0x1ff}]}, 0x14, 0x2)
accept4$unix(r47, 0x0, &(0x7f0000000380), 0x80000)
creat(&(0x7f0000000300)='./file0\x00', 0x161)
futimesat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={{0x0, 0x2710}})
sendto$unix(0xffffffffffffffff, &(0x7f0000000500)="81be9346fbfe62133a6f6ca3a38fab17f9e1e94620a270a774e8eb1829c599515c5d346330a966a60ad1da7c5ef7e34bf4c3816f0214533468861c78cda91719c1b8c0c6aba330677a3e2b09442b103f029c6945ff4213607f11063acb442361bc8c26438d1abb8eead6879d61642a5d6c4d0b9f1e7bf5d5d2dd9bc6d2e4cd78dc71808cf73c69105247334ca83c2b168740e91bf382b2b7584d7331f700fb5eb98f1d55fff90da35b4ecb6baee89eea3606eb1875a8d74d8b5d0a8780fbd981205da30cfdda06b830dad829b0e5ef2623fea2d44b4611e5", 0xd8, 0x20000040, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x3, 0x4)
setsockopt$inet_MCAST_JOIN_GROUP(r47, 0x0, 0x2a, &(0x7f00000000c0)={0x3fe00000000, {{0x2, 0x4e23, @multicast2}}}, 0x88)
connect$inet6(0xffffffffffffffff, &(0x7f00000004c0)={0xa, 0x4e21, 0xffffffffffff1d12, @rand_addr="35b75d67778ca429c838a53cd8c1814f", 0x200}, 0x1c)
connect$unix(r47, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e22}, 0x6e)
write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0)
r48 = getpgrp(0xffffffffffffffff)
sched_getaffinity(r48, 0x0, 0x0)
r49 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r49, 0xc018620b, 0x0)
ioctl$BINDER_WRITE_READ(r49, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
r50 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x1000000000000, 0x0, 0xffffffbd}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x35}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x265, &(0x7f000000cf3d)=""/195}, 0x48)
ioctl$TUNGETFILTER(r50, 0x801054db, &(0x7f0000000040)=""/160)
r51 = socket$inet(0x2, 0x4000000000000001, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
r52 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendto$inet6(r52, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast1={0xff, 0x3}, 0x40}, 0x1c)
setsockopt$inet_tcp_TCP_CONGESTION(r51, 0x6, 0xd, 0xffffffffffffffff, 0x0)
r53 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r53, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)})
ioctl$BINDER_WRITE_READ(r53, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})